_steviec (Community Member) asked a question.
Rather than having an ugly list of bindable properties in a controller method, it would be neater to use the Bindable(bool) attribute on the view model.
Hi @_steviec (Community Member) ,
Veracode Static Analysis does not detect use of the Bindable attribute on a model property as remediation for CWE 915, but used appropriately this can be an excellent basis for a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) that you can then ask your mitigation reviewer to review.
Automatic detection of the Bindable attribute on a model property has as a potential downside that while a property may be fine in one context, it may not be in another, think of for example a Password property on a User model. While it might be perfectly fine to have this bindable in the ResetPassword action, in any other context it should likely not be bindable.
But we are actively working on better being able to detect correct and secure usage of ViewModels, so please consider registering your ideas on this with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema
Thanks for your really quick response. Yes, I had thought of that too, that using the Bind attribute does allow for a finer grain of control.
As you recommend, I'll propose a mitigation.
.png){kind=logo}
Hi @_steviec (Community Member) ,
Veracode Static Analysis does not detect use of the Bindable attribute on a model property as remediation for CWE 915, but used appropriately this can be an excellent basis for a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) that you can then ask your mitigation reviewer to review.
Automatic detection of the Bindable attribute on a model property has as a potential downside that while a property may be fine in one context, it may not be in another, think of for example a Password property on a User model. While it might be perfectly fine to have this bindable in the ResetPassword action, in any other context it should likely not be bindable.
But we are actively working on better being able to detect correct and secure usage of ViewModels, so please consider registering your ideas on this with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema